JadePuffer is the first ransomware attack run end to end by an AI agent, with no human operator. Its entry point was a critical flaw left unpatched for a year.